---
id: CVE-2026-92499
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ext4: validate readdir offset before accessing dirent

  A corrupted directory can trigger the following KASAN report when
  ext4_readdir() resumes from an invalid position…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ext4: validate readdir offset before accessing dirent

  A corrupted directory can trigger the following KASAN report when
  ext4_readdir() resumes from an invalid position…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ac27a0ec112a089f1a5102bc8dffc79c8c815571 <
    64d445d40e5ea4c4d4d88880db753b370cb69161
  - >-
    Linux >= ac27a0ec112a089f1a5102bc8dffc79c8c815571 <
    b4c728577933753180e3e97f08424d5bcaff705e
  - >-
    Linux >= ac27a0ec112a089f1a5102bc8dffc79c8c815571 <
    bc4b7b0414c33b2c8898eb04386df0d21a13dad8
  - Linux 2.6.19
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:52.280'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92499'
references:
  - url: 'https://git.kernel.org/stable/c/64d445d40e5ea4c4d4d88880db753b370cb69161'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b4c728577933753180e3e97f08424d5bcaff705e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bc4b7b0414c33b2c8898eb04386df0d21a13dad8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.783Z'
epss: 0.00206
epssPercentile: 0.09458
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ext4: validate readdir offset before accessing dirent

A corrupted directory can trigger the following KASAN report when
ext4_readdir() resumes from an invalid position:

  BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ef/0x820
  Read of size 2 at addr ffff88810a646000 by task repro_linear/509

  Call Trace:
   <TASK>
   dump_stack_lvl+0x53/0x70
   print_report+0xd0/0x630
   kasan_report+0xce/0x100
   __ext4_check_dir_entry+0x5ef/0x820
   ext4_readdir+0xcde/0x2b70
   iterate_dir+0x1a1/0x520
   __x64_sys_getdents64+0x12b/0x220
   do_syscall_64+0xf9/0x540
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>

KASAN reports use-after-free because the out-of-bounds access lands in an
adjacent freed page. The directory buffer itself is still referenced.

ext4_dir_llseek() invalidates the directory cookie so that ext4_readdir()
rescans directory entries from the start of the block. The rescan checks
only the lower bound of rec_len before advancing. A corrupted rec_len can
therefore place the offset where the block has insufficient space for a
complete directory entry. The rescan itself may dereference that truncated
entry, or the main loop may pass it to __ext4_check_dir_entry(). The latter
reads de->rec_len before validating the range. For example:

  block offset  0                           4092  4096
                |---- de1.rec_len = 4092 -----|----|
                                               de2.inode
                                                    | de2.rec_len
                                                    ^ OOB, reported as UAF

de2 starts at offset 4092 in this 4 KiB block. Its four-byte inode fits in
the block, but its rec_len starts at offset 4096 and crosses the boundary.

The minimum safe length is inode-dependent. Encrypted and casefolded
directory entries need eight additional hash bytes, while a valid metadata
checksum tail is only 12 bytes.

Cache the metadata checksum feature state and derive the minimum directory
entry length from the on-disk format. Use it to bound both the rescan and
the offset passed to the main loop. Report an offset in a truncated block
tail and skip the remainder of the block, while continuing to accept an
offset exactly at the block boundary.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.